GDPR: Belgium sets up new Data Protection Authority

On 10 January, the Belgian Gazette published the Law of 3 December 2017 “setting up the authority for data protection” (the Law).

The Law is the first legal text in Belgium applying various provisions of the EU’s General Data Protection Regulation (GDPR). Under the GDPR, EEA Member States must provide for one or more independent public authorities to be responsible for monitoring the application of the GDPR, in order to protect fundamental rights and freedoms of personal persons in relation to processing and to facilitate the free flow of personal data within the European Union. The Law therefore sets up a new “Data Protection Authority” (DPA), which, with effect from 25 May 2018, replaces the current body, the Commission for the Protection of Privacy (Privacy Commission).

Although not a “big player,” Belgium is often at the forefront of developments in EU law, including in the protection of privacy. The DPA’s predecessor, the Privacy Commission, has been an active data protection agency, for example it has also been one of several authorities across the EU which has sued social media providers.

The DPA will doubtless continue the Privacy Commission’s advisory role, but the Law also grants extensive powers to the DPA: it remains to be seen whether the DPA will merely exhort rather than enforce. Much will depend on the composition of its Executive Committee. The DPA will need to press for sufficient budget to attract the personnel necessary to exercise its powers and to burnish its image as a truly independent authority.

If the DPA does “show its teeth,” the Law’s extensive provisions on investigations by the DPA’s Inspection Service, preliminary measures by its Disputes Chamber and on the Chamber’s proceedings on the merits will become familiar reading. The rights of the defense and other safeguards guaranteed in the Law will be put to the test. The ultimate sanction is, however, loss of reputation: no serious economic operator wants to face allegations – often highly publicized – that it has been negligent in its protection of the personal data of its customers.

Stewart Baker

Stewart served as the first Assistant Secretary for Policy at the Department of Homeland Security where he set cybersecurity policy, including inward investment reviews focused on network security. More

About This Blog

Steptoe Cyberblog, with its sometimes contrasting insights, serves up opinionated and provocative thoughts on the issues — especially cybersecurity and privacy — that arise at the intersection of law, information technology, and security.

Stay Connected To Steptoe

About Steptoe

Steptoe & Johnson LLP is an international law firm widely recognized for vigorous advocacy in complex litigation and arbitration, successful representation of clients before governmental agencies, and creative and practical advice in guiding business transactions. The firm has more than 500 lawyers and other professionals in offices in Beijing, Brussels, Chicago, London, Los Angeles, New York, Phoenix, San Francisco and Washington. For more information, visit the Steptoe website www.steptoe.com or contact us directly by visiting our Contact Page.